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Abstract: We demonstrate the decoy-state quantum key distribution over 
200 km with photon polarization through optical fiber, by using super- 
conducting single photon detector with a repetition rate of 320 Mega Hz and 
a dark count rate of lower than 1 Hz. Since we have used the polarization 
coding, the synchronization pulses can be run in a low frequency. The final 
key rate is 14.1 Hz. The experiment lasts for 3089 seconds with 43555 total 
final bits. 
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1. Introduction 

Compared with the existing classical private communication methods, quantum key distribu- 
tion (QKD) is believed to have the special advantage of unconditional security. Since Bennett 
and Brasard [1] proposed their protocol (the so called BB84 protocol) QKD has now been ex- 
tensively studied both theoretically [1-14] and experimentally. The central issue of QKD in 
practice is its unconditional security. The real set-up can actually be different from the assumed 
ideal case in many aspects. For example, the existing real set-ups use an imperfect single- 
photon source with a lossy channel, which is different from the assumed ideal protocol where 
one can use a perfect single-photon source. Therefore, the security is undermined by the photon- 
number-splitting attack [9, 10]. Fortunately, there are a a number of methods [4,5, 11-24] can 
be used to overcome the issue in practical QKD where we only use the imperfect source. The 
ILM-GLLP proof [5, 6] has shown that if we know the upper bound of fraction of the multi- 
photon counts (or equivalently, the lower bound of single-photon counts) among all raw bits, 
we still have a way to distill the secure final key. Verifying such a bound is strongly non-trivial. 
One can faithfully estimate such bounds with the decoy-state method [4, 11-14], where the 
intensity of pulses are randomly changed among a few different values. 

So far the decoy-state method has been extensively studied in many experiments [25-38] 
with different realization methods, including the phase coding method [25, 28, 29], the photon 
polarization method [26,27], in free space [27] and optical fiber [26,28,29]. The recently 
developed superconducting detector technology can significantly improve the QKD distance 
[29-33]. So far, the most updated record of the QKD distance is 250km [32], reported by 
Stucki et al. However, the decoy-state method is not implemented there. 

Different realizations of BB84 protocol may have different technical advantages and dis- 
advantages. For example, polarization coding has its advantage in passively switching the 
measurement basis, while optical fiber based QKD can be directly developed for a network 
secure private quantum key distribution [34]. However, photon polarization may change signif- 
icantly over long distance transmission through an optical fiber. Robust polarization transmis- 
sion in optical fiber has been achieved by optical compensation [26, 39]. 

Here we report our new experimental result with photon polarization transmitted by opti- 
cal fiber, over a distance of 200km. Our result here has kept the advantages of polarization 
coding and optical-fiber based photon transmission as our earlier result [26], but has reached 
a longer secure distance by using superconducting detectors. Also, as shown below, together 
with a superconducting detector, the polarization coding can have one more advantage in the 
synchronization. In principle, the synchronization pulses are not necessary in our system if one 
has a very precise local clock at the detection side. 

2. Polarization coding, superconducting detector, and synchronization 

In a BB84 protocol [1], there is a sender, Alice and a receiver, Bob. Besides sending Bob the 
weak coding pulses of BB84 states, Alice also sends Bob synchronization pulses as a clock, so 
that Bob can know the position of each of his detected results. In principle, the synchronization 
pulses do not have to be run in the same frequency with the weak coding pulses. For example, 
if Bob has a very precise clock, they don't need the high frequency synchronization pulses in 



the whole protocol. However, in all existing real set-ups, even we have such an expensive clock, 
the high frequency synchronization is still necessary because they are needed in measurement, 
if we use phase coding or if we use the gated mode for the single photon detector. 

Consider a system using phasing coding first. There, the signal detection at Bob's side is 
done actively. Immediately before the detecting each individual signals, an active phase shift 
is taken to the signal pulse, which works as the random selection of measurement basis. In 
such a system, each individual signal pulse must be accompanied by a synchronization pulse 
as a clock so that the phase shift can be done at the right time. Second, consider a system with 
normal single-photon detectors, using either phase coding or polarization coding. In this case, 
normally the detector is run in a frequency of a few Mega Hertz. The detector has to be run in 
a gated mode, otherwise there will be too many dark counts and no final key can be distilled 
out. Such a gated mode also requires each coding signal be accompanied by a synchronization 
pulse so that the detector is gated at the right time window in detecting each coding signal. 

The situation is different if one uses polarization coding with a superconducting detector. 
First, the detector's repetition rate is so high that it can be run in the always-on mode rather 
than the gated mode. Second, unlike the case of phase coding, photon polarization detection is 
done passively. There is no active operation on each signal. Therefore, in principle, in such a 
case, the synchronization pulses are not necessary in the system, if one has a very precise local 
clock. A very precise local clock is technically difficult and expensive. However, the existing 
economic local clock technology can run rather precisely in a short period. This allows one to 
make the synchronization block by block, given such a simple local clock at Bob's side. Say, 
one needs only one synchronization pulse for a block of (many) signals. 

3. Our set-up 

Our set-up is shown schematically in Figure 1 . Two sides, Alice and Bob are linked by 200 km 
optical fiber. Decoy pulses of BB84 polarization states are sent to Bob through the optical fiber. 
They are detected at Bob's side by superconducting single-photon detectors. 

3.1. Source 

We use the weak coherent light as our source. The main idea of the decoy-state method is to 
change intensities randomly among different values in sending out each pulses. Here we change 
the intensity of each pulses among 3 different values: 0, 0.2, 0.6, which are called vacuum pulse, 
decoy-pulse, and signal pulse, respectively. Alice's probabilities of sending a vacuum pulse, a 
decoy pulse and a signal pulse are 1:1:2 . The experiment lasts for 3089 seconds. 

As shown in Fig.l, the coherent light pulses in our experiment are produced by 8 diodes 
which are controlled by 4-bit random numbers random numbers. The first two bits of a random 
number determines whether to produce a vacuum pulse, a decoy pulse, or a signal pulse. In 
particular, if they are 00, none of the diode sends out any pulse, i.e., a vacuum pulse is produced; 
if they are 01, one of the 4 decoy diodes in the figure produces a decoy pulse; if they are 10 or 
11, one of the 4 signal diodes in the figure produces a signal pulse. The last 2 bits of the 4-bit 
random number decides which of the 4 diodes is chosen to produce the pulse (If the first two 
bits are not 00 ). The light intensities are controlled by an attenuator after each diodes, 0.2 for 
the decoy pulse and 0.6 for the signal pulse. Each diodes will produce only one polarization 
from the 4 BB84 states, i.e., the horizontal, vertical, n/A, 3n/4. Polarization maintaining beam 
splitters (PMBS) are used to guide pulses from the decoy diode and the signal diode in the same 
polarization block into one PMBS. Two polarization maintaining polarization beam splitters are 
used to guide pulses from all diodes to one optical fiber. The fidelity of our polarization states is 
larger than 99.9%. The Pulses produced by the laser diodes first passes through a polarization 
maintaining beam-splitter (BS), then a polarization beam splitter (PBS) and then combined by 
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Fig. 1. Schematic diagram of our set-up. BS: polarization maintaining beam splitter, PBS: 
polarization maintaining polarization beam splitter, SBS: single mode beam splitter, SPBS: 
single mode polarization beam splitter, FF: 0.2nm bandpass filter, Att: attenuator, SOA: 
Semiconductor Optical Amplifier, PD: photo detector, TDC: Time to Digital Converter. 
PC: polarization controller. 



a single mode BS. These pulses are sent to Bob through the optical fiber of a 200 km long, in 
side the lab. 

3.2. Detection 

The circuit at Bob's side is is a standard design of BB84 detection. Four super-conducting 
single-photon detectors are used to detect signals. These detectors are made by Scontel com- 
pany in Russia. We have set the environmental temperature lower than 2.4k. The dark count 
rate of each detectors is smaller than 1 Hz and the detection efficiency of 3 of them is larger 
than 4%, one of them is larger than 3%. 

3.3. Clock 

The 40k Hz synchronization pulses are originated from the 320M Hz clock which drives a laser 
diode to produce synchronization pulses. In order to observe the detect the synchronization 
pulses at Bob's side which is linked to Alice by 200 km optical fiber, a semiconductor optical 
amplifier is inserted at the point of 100 km, amplifying the intensity of optical pulses by 100 
before transmission over the second half of the optical fiber. At Bob's side, a photon-electrical 
detector is used to recover the synchronization pulses. Both the synchronization pulses and the 
electrical signal from the superconductor detector are sent to a time-to-digit convertor (TDC) 
which works as an "economic local clock". 

4. Calculation of the final key 

The secure final keys can be distilled with an imperfect source given the separate theoretical 
results from Ref. [5]. We regard the upper bound of the fraction of tagged bits as those raw bits 
generated by multiphoton pulses from Alice, or equivalently, the lower bound of the fraction 
of untagged bits as those raw bits generated by single-photon pulses from Alice. In Wang's 
3-intensity decoy-state protocol [12], Alice can randomly use 3 different intensities (average 
photon numbers) of each pulses (0, /i, /i')as the vacuum pulses, decoy pulses and signal pulses. 
Alice produce the states by different intensities in EqQ] 

p M |0)(0|+/x*-" 1 1)(1 1 +cp c , 

p M , = |0) (0\+p'e-»'\l) <1| + ^cp c . + dp d . 



Here c = 1 — — /le - ^, p c = e —^- Y7i=2 "in" \ n ) ( n \'Pd is a density operator, and d > 0(here 
we use the same notation in Ref. [12]. In the protocol, Bob records all the states which he 
observed his detector click. After Alice sent out all the pulses, Bob announced his record. 
Then they known the number of the counts Co, C^, C^i which came from different intensities 
0, ji, fl'. Nq, Np, Npi are the pulse numbers of intensity 0, fi, jJ. ! which Alice sent out. The 
counting rates (the counting probability of Bobs detector whenever Alice sends out a state) 
of pulses of each intensities can be calculate Sq = Cq/Nq, = C^/N^ and 5V = Cn'/N^i, 
respectively. We denote soCs{))> ^lC^i) an d s c{s' c ) f° r the counting rates of those vacuum pulses, 
singlephoton pulses, and p c pulses from p^ip^i). Asymptotically, the values of primed symbols 
here should be equal to those values of unprimed symbols. However, in an experiment the 
number of samples is finite; therefore they could be a bit different. The bound values of s\, s\ 
can be determined by the following joint constraints equations: 

Su = <?~ M so + jle^^si + cs c , 

M 2 e~ M ( o ,,i„-u'j „-u'j\ (2) 

x a e~ 

where s\ = (1 - ^=>i, 4 = (1 ~^>c. *o = (1 -H>>Sq, so = (l+r )S , and r = ^ 

to obtain the worst-case results [12]. Given these, one can calculate s\, s\, s c numerically. 

In the experiment, Alice totally transmits about N pulses to Bob. After the transmission, Bob 
announces the pulse sequence numbers and basis information of received states. Then Alice 
broadcasts to Bob the actual state class information and basis information of the corresponding 
pulses. Alice and Bob can calculate the experimentally observed quantum bit error rate (QBER) 
values Efi, E^i of decoy states and signal states according to all the decoy bits and a small 
fraction of the signal bits, respectively. Since we exploit and E^i from finite test bit, the 
statistical fluctuation should be consider to evaluate the error rate of the remaining bit. 



tfi'in) * s tne P ro P or ti° n °f the test bits for the phase-flip test in single states (decoy state). Then 
we can numerically calculate a tight lower bound of the counting rate of single-photon s\ using 
Eq. ©. The next step is to estimate the fraction of single-photon Ai and the QBER upper bound 
of single-photon E\ . We use 

Af' = si/iV-f'/V^i = J iM«~ M /S/i (4) 

to conservatively calculate Ai of signal states and decoy states, respectively [12]. And E\ of 
signal states and decoy states can be estimated by the following formula: 

Here we consider the statistical fluctuations of the vacuum states to obtain the worst-case re- 
sults. 

Lastly, we can calculate the final key rates of signal states using the following formula [12]: 



(6) 



Here H(x) = —xlog2(x) — (1 — x)log2(l —x). 



We consider the final key rate of the decoy states independently. During the above calcula- 
tion, we have used the worst case results in every step for the security. Obviously, there are more 
economic methods for the calculation of final key rate of the decoy states. Here we have not 
considered the consumption of raw keys for the QBER test. Now we reconsider the key rate cal- 
culation of decoy states above. We assumed the worst case of so — (1 + ro)So and so = (1 — ro)So 
for calculating A^ 1 and Zsf , respectively. Although we do not exactly know the true value of 
so, there must be one fixed value for both calculations. Therefore we can choose every possible 
value in the range of (1 — 7*o)So < s o < (1 + ro)So and use it to calculate Aj , and the final 
key rate, and then pick out the smallest value as the lower bound of decoy states key rate. As 
the Fig. 3 in [26] , we set so = (1 — ro)So to calculate the lower bound of decoy states key 
rate. This economic calculation method can obtain a more tightened value of the lower bound, 
which is larger than the result using the simple calculation method above with the two-step 
worst-case assumption for so values. We can calculate the final key rates of decoy states using 
the following formula with Equ.[3] 

K M =S M [A? -#(£ M )-A?J? (£{*)]. (7) 

Half of the experimental data should be discarded due to the measurement basis mismatch in 
the BB84 protocol. Among the remaining half, the ratio L^,,^ are consumed for the phase-flip 

test and L^,,^-. are consumed for the bit-flip test. Then we can calculate the final rate which 
exploit from single states and decoy states. 

fyGO = \( l - lP h'(h) ( 8 ) 

In the experiment, the pulse numbers ratio of the 3 intensities 0, fi and /J.' is 1:1:2 and the 
intensities of signal states and decoy states are fixed at ji' = 0.6 and fi = 0.2, respectively. 
The numbers of the counts from 0, jJ. anf are 3263, 77157 and 449467. We calculate the 
experimentally observed QBER values E^, En' of decoy states and signal states are 4.0426%, 
1.964%. The experiment lasts for T = 3089 seconds. We use L p , = = 10% for phase-flip 

test, and L^, =Lj l = 5% for bit-flip test. The experimental parameters and their corresponding 
values are listed in Table Q] After calculation, we obtain a final key rate of 11.8 bits/s for the 
signal states (intensity jj.' = 0.6) and a final key rate of 2.9 bits/s for the decoy states (intensity 
At =0.2). 



Table 1. Experimental parameters (P) and their corresponding value of 200 km (Value) 
decoy-state QKD. 
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5. Concluding remarks 

In summary, with a superconducting detector, we have demonstrated a decoy-state QKD over 
200km distance in polarization coding and optical fiber. In our experiment, the synchroniza- 



tion system is significantly simplified. In principle, the frequent synchronization pulses are not 
necessary in our set-up if one has a very precise local clock. 
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